The internet became into existence to fulfill our need to share and access information. Initially built as a way to more easily share information between research institutions, it is now an integrated part of our lives. The expansion into the network we know today started in the 90’s with the release of the World Wide Web (WWW). Along this transformation, the way we access the WWW changed and shaped the various business models that were applied on the internet. The most notable influence is the raise of behavioural studies. The knowledge coming from these studies allows to understand how to describe and categorize someone’s behaviour based on their actions, without specifically knowing this person. Together with digitization, which causes an all time high in the amount of information produced and available, behavioural studies enabled specific targeting of individuals. This approach turned into the default business model of the internet. For the first time in history, information is a commodity and capable of creating revenue. However, this all happens in the background, without the audience on the internet being aware what exactly is happening. Several example show that it goes beyond what society deems acceptable. Cambridge Analytica being the latest big scandal, Facebook has had more scandals, but also warehouse chain Target in an earlier stage caused public astonishment. This thesis researches how the tools given by the GDPR function and to what extent they open up the processes we normally don’t see. The research shows that the tools available to individuals are not enabling them to take control over their privacy, nor do they help the individual to understand the complex network of companies only gathering as much information as they can. This thesis concludes with proposing a new approach to how we approach privacy, based on Nissenbaum’s ‘privacy in context’. Instead of putting all the responsibility at the level of the individual, we should create a shared responsibility in the form of contexts. The same way as we have defined contexts of information flows outside of the internet, we have to redefine them again in the context of the internet. The internet fundamentally changes how information flows, therefore we have to redefine what flows we deem acceptable and which not, as society, not only determined by companies, as is the case now.